flow-next-opencode-sync

Pass

Audited by Gen Agent Trust Hub on Apr 7, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes a bundled binary flowctl located in the .opencode/bin/ directory. This is used to query task information and update specifications.
  • Evidence: The script explicitly defines FLOWCTL="$OPENCODE_DIR/bin/flowctl" and uses it for config get, show, and tasks commands.
  • [COMMAND_EXECUTION]: Shell utilities like git, jq, and sed are used for environment validation and argument parsing.
  • Evidence: Uses git rev-parse --show-toplevel to find the project root and jq to parse JSON output from the local tool.
  • [SAFE]: The skill implements input validation for the $ARGUMENTS variable, checking that the provided ID follows the expected fn- format before processing, which mitigates simple command injection risks.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 7, 2026, 09:07 AM